Setting up automatic acquisition of letsencrypt certificates using docker on linux

I recently changed my virtual server and had to set everything up again. I prefer that the site is available via https and that letsencrypt certificates are obtained and renewed automatically. This can be achieved by using two docker images: nginx-proxy and nginx-proxy-companion.

This guide explains how to set up a site on docker, with a proxy that automatically obtains SSL Certificates. A virtual server running CentOS 7 is used.

I assume the server has already been purchased, configured, access is provided via key, fail2ban is installed, etc.

First, you need to install docker.

1. First, you need to install dependencies

   $ sudo yum install -y yum-utils device-mapper-persistent-data lvm2

2. Connect the repository

   $ sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

3. Then install docker community edition

   $ sudo yum install docker-ce docker-ce-cli containerd.io

4. Add docker to autostart and start it

   $ sudo systemctl enable docker
   $ sudo systemctl start docker

5. Add the user to the docker group to be able to run docker without sudo

   $ usermod -aG docker user

The next step is to install docker-compose. The utility can be installed in several ways, but I prefer to install it through the pip manager and virtualenv to avoid cluttering the system with unnecessary packages.

1. Install pip

   $ sudo yum install python-pip

2. Install virtualenv

   $ pip install virtualenv

3. Next, you need to create a project folder and initialize it. The folder containing everything needed for package management will be called ve.

   $ mkdir docker
   $ cd docker
   $ virtualenv ve

4. To start using the virtual environment, you need to run the following command in the project folder.

   $ source ve/bin/activate

5. You can now install docker-compose.

   pip install docker-compose

   To allow the containers to see each other, we will create a network. The bridge driver is used by default.

   $ docker network create network

   Next, you need to configure docker-compose, the proxy will be in the proxy folder, and the test site will be in the test folder. For this example, I use the domain name example.com

   $ mkdir proxy
   $ mkdir test
   $ touch proxy/docker-compose.yml
   $ touch test/docker-compose.yml

   Contents proxy/docker-compose.yml

   version: '3'
   
   networks:
     default:
       external:
         name: network
   
   services:
     nginx-proxy:
       container_name: nginx-proxy
       image: jwilder/nginx-proxy
       ports:
         - 80:80
         - 443:443
       volumes:
         - certs:/etc/nginx/certs
         - vhost.d:/etc/nginx/vhost.d
         - html:/usr/share/nginx/html
         - /var/run/docker.sock:/tmp/docker.sock:ro
   
     nginx-proxy-letsencrypt:
       container_name: nginx-proxy-letsencrypt
       image: jrcs/letsencrypt-nginx-proxy-companion
       volumes: 
         - certs:/etc/nginx/certs
         - vhost.d:/etc/nginx/vhost.d
         - html:/usr/share/nginx/html
         - /var/run/docker.sock:/var/run/docker.sock:ro
       environment:
         - NGINX_PROXY_CONTAINER=nginx-proxy
   
   volumes:
     certs:
     vhost.d:
     html:

   Environment Variable NGINX_PROXY_CONTAINER is required for the letsencrypt container to see the proxy container. The folders /etc/nginx/certs /etc/nginx/vhost.d and /usr/share/nginx/html must be shared between both containers. For the letsencrypt container to work properly, the application must be accessible on both port 80 and port 443.

   Contents test/docker-compose.yml

   version: '3'
   
   networks:
     default:
       external:
         name: network
   
   services:
   
     nginx:
       container_name: nginx
       image: nginx:latest
       environment:
         - VIRTUAL_HOST=example.com
         - LETSENCRYPT_HOST=example.com
         - LETSENCRYPT_EMAIL=admin@example.com

   Here, the environment variables are necessary for the proxy to correctly handle requests to the server and request a certificate for the correct domain name.

   All that's left is to run docker-compose

   $ cd proxy
   $ docker-compose up -d
   $ cd ../test
   $ docker-compose up -d

Source: habr.com